From 0023cee85d2e02c5ec5630afe31854a4539cae0a Mon Sep 17 00:00:00 2001 From: hanzo-dev Date: Mon, 3 Aug 2026 13:27:44 -0700 Subject: [PATCH 1/2] legal: declare MIT OR Apache-2.0 in every manifest, matching the LICENSE files The crate manifests offered a licence candle never granted, and that this repo did not ship the text of. The LICENSE files and the manifests had disagreed for nearly seven months. How it happened: 216fae85 (2026-01-16) flipped 24 manifests from "MIT OR Apache-2.0" to "BSD-3-Clause OR Apache-2.0" and added LICENSE-BSD. candle is MIT OR Apache-2.0 and offers no BSD option, so BSD-3-Clause was never ours to offer over candle-derived code. 16fabaed (2026-07-02) then deleted LICENSE-BSD as "stray" and touched no manifest. From that date the repo advertised BSD-3-Clause in 27 manifests while shipping no BSD text at all. LICENSE-MIT, LICENSE-APACHE and NOTICE said "MIT OR Apache-2.0" throughout. Those are the files that actually grant rights. Fixed forward: 27 manifests now declare "MIT OR Apache-2.0" -- the 24 that said "BSD-3-Clause OR Apache-2.0", plus hanzo-kernel, hanzo-kernel-macros and hanzo-3d, which said "BSD-3-Clause" alone with no Apache fallback. Those three are first-party Hanzo work rather than candle-derived, so the choice was ours; they are aligned so every crate offers what the repo actually ships. hanzo-bindgen-cuda is deliberately LEFT at "MIT". It is a fork of bindgen_cuda by Nicolas Patry (github.com/Narsil/bindgen_cuda), MIT upstream, and its manifest still credits him. Normalising it would have relicensed a third party's work -- the blanket instruction would have swept it up, so it is called out here to stop the next person redoing it. NOT yanking the published versions. 191 versions across 12 crates carry the wrong SPDX; 25 of them -- all of hanzo-kernel, hanzo-kernel-macros and hanzo-3d -- went out as BSD-3-Clause with no Apache fallback at all. crates.io metadata is immutable per version, so it cannot be edited; yanking would break every downstream consumer to correct a label. The LICENSE files inside each published package were always LICENSE-MIT and LICENSE-APACHE. NOTICE records this so the next reader understands why old versions differ. No LICENSE file is touched. NOTICE gains a "LICENSE METADATA CORRECTION" section; LLM.md carries the rule and the layout note (flat crate dirs mirror candle -- there is no crates/ directory and its absence is not a bug). Flagged, not fixed: the root LICENSE is not upstream's. candle ships no /LICENSE; ours was added by 225e590f and is a MODIFIED Apache-2.0 with the APPENDIX replaced and sentences reworded. It is why GitHub reports this repo as Apache-2.0 rather than dual-licensed. Left alone -- changing a file named LICENSE is a licensing determination, not a metadata fix. Co-authored-by: Hanzo Dev --- LLM.md | 50 ++++++++++++++ NOTICE | 68 +++++++++++++++++++ hanzo-3d/Cargo.toml | 2 +- hanzo-datasets/Cargo.toml | 2 +- hanzo-flash-attn-build/Cargo.toml | 2 +- hanzo-flash-attn-v3/Cargo.toml | 2 +- hanzo-flash-attn/Cargo.toml | 2 +- hanzo-kernel-macros/Cargo.toml | 2 +- hanzo-kernel/Cargo.toml | 2 +- hanzo-kernels/Cargo.toml | 2 +- hanzo-metal-kernels/Cargo.toml | 2 +- hanzo-ml-book/Cargo.toml | 2 +- hanzo-ml-examples/Cargo.toml | 2 +- hanzo-ml-pyo3/Cargo.toml | 2 +- hanzo-ml-wasm-examples/bert/Cargo.toml | 2 +- hanzo-ml-wasm-examples/blip/Cargo.toml | 2 +- hanzo-ml-wasm-examples/llama2-c/Cargo.toml | 2 +- hanzo-ml-wasm-examples/moondream/Cargo.toml | 2 +- hanzo-ml-wasm-examples/phi/Cargo.toml | 2 +- .../segment-anything/Cargo.toml | 2 +- hanzo-ml-wasm-examples/t5/Cargo.toml | 2 +- hanzo-ml-wasm-examples/whisper/Cargo.toml | 2 +- hanzo-ml-wasm-examples/yolo/Cargo.toml | 2 +- hanzo-ml/Cargo.toml | 2 +- hanzo-nn/Cargo.toml | 2 +- hanzo-onnx/Cargo.toml | 2 +- hanzo-training/Cargo.toml | 2 +- hanzo-transformers/Cargo.toml | 2 +- hanzo-ug/Cargo.toml | 2 +- 29 files changed, 145 insertions(+), 27 deletions(-) diff --git a/LLM.md b/LLM.md index 50001ca19..bb9676e57 100644 --- a/LLM.md +++ b/LLM.md @@ -28,3 +28,53 @@ with quantization (GGUF/GGML/AFQ/GPTQ/AWQ). The compute core beneath Hanzo infer - **Zen** models are our own family — don't present upstream model names as ours. Spec: `~/work/hanzo/SDK-ARCHITECTURE.md` — the canonical one-way SDK model. + +## Licensing — read before touching a manifest + +Fork of **candle** (huggingface/candle), **MIT OR Apache-2.0**. `NOTICE` is the +full record. The layout is flat (`hanzo-ml/`, `hanzo-nn/`, …) because candle's +is flat — there is no `crates/` directory and its absence is not a bug. + +- **Never edit `LICENSE-MIT` or `LICENSE-APACHE`.** They are upstream's texts and + they are what actually grant rights. +- **Every crate declares `MIT OR Apache-2.0`.** One exception, deliberate: + `hanzo-bindgen-cuda` declares `MIT`, because it is a fork of `bindgen_cuda` + by Nicolas Patry (github.com/Narsil/bindgen_cuda) which is MIT upstream, and + its manifest retains his authorship. Do not "normalise" it — that would + relicense a third party's work. + +### The bug that shipped 191 times + +From 2026-01-16 to 2026-08-03 the manifests declared a licence candle never +granted. `216fae85` flipped 24 manifests to `BSD-3-Clause OR Apache-2.0` and +added `LICENSE-BSD`; `16fabaed` later deleted `LICENSE-BSD` as "stray" without +touching a single manifest. For seven months the repo *offered* BSD-3-Clause +while shipping no BSD text, and `hanzo-kernel` and `hanzo-3d` offered +`BSD-3-Clause` with no Apache fallback at all. + +All 27 manifests were corrected to `MIT OR Apache-2.0` on 2026-08-03. The **191 +already-published versions across 12 crates** are **not** being yanked: +crates.io metadata is immutable per version, the LICENSE files inside each +package are what govern, and yanking would break every consumer to fix a label. +(25 of those — all of `hanzo-kernel`, `hanzo-kernel-macros`, `hanzo-3d` — went +out as `BSD-3-Clause` with no Apache fallback at all.) + +Verify the count yourself rather than trusting a number in a doc; crates.io +rejects anonymous requests, so send a User-Agent: + + curl -s -A "you@hanzo.ai" https://crates.io/api/v1/crates/hanzo-ml \ + | jq '[.versions[].license] | group_by(.) | map({(.[0]): length}) | add' + +The lesson worth keeping: `license =` in a manifest is a *claim*, and the +LICENSE files are the *fact*. When they disagree, the files win — and a +find-and-replace across manifests is a licensing change, not a chore. + +### Open item — the root `LICENSE` is ours, not candle's + +candle ships no `/LICENSE` (only `LICENSE-MIT` + `LICENSE-APACHE`). Ours was +added by `225e590f` and is a **modified** Apache-2.0: the APPENDIX is replaced +with a `Copyright 2024 Hanzo AI Inc` line and several sentences are reworded. +Because it is the only file named `LICENSE`, GitHub reads it and reports this +repo as Apache-2.0 rather than dual-licensed. Left untouched pending a +decision — altering a file named LICENSE is a licensing call, not a metadata +fix. Flagged, not resolved. diff --git a/NOTICE b/NOTICE index a41b4cd95..d2bbe06eb 100644 --- a/NOTICE +++ b/NOTICE @@ -95,3 +95,71 @@ Changes from upstream candle in this fork: Hanzo/zen model hubs. - Dependency and layout changes: cudarc pinned at 0.19.4; an orphaned duplicate crate cluster is excluded from the workspace build. + +LICENSE METADATA CORRECTION (2026-08-03) + +Between 2026-01-16 and 2026-08-03 the crate manifests in this repository +declared a license that upstream candle never granted, and that this repository +did not ship the text of. This section records that, because published crate +metadata is immutable and old versions still carry it. + +What happened: + +- Commit 216fae85 (2026-01-16) changed 24 manifests from "MIT OR Apache-2.0" to + "BSD-3-Clause OR Apache-2.0" and added a LICENSE-BSD file. candle is licensed + "MIT OR Apache-2.0" and offers no BSD-3-Clause option, so BSD-3-Clause was + never ours to offer over candle-derived code. +- Commit 16fabaed (2026-07-02) deleted LICENSE-BSD as "stray" but did not touch + a single manifest. From that date the repository offered BSD-3-Clause in 27 + manifests while shipping no BSD license text at all. +- Meanwhile LICENSE-MIT, LICENSE-APACHE and this NOTICE all correctly said + "MIT OR Apache-2.0". The license files and the manifests disagreed for + nearly seven months, and the license files are the ones that govern. + +What was corrected on 2026-08-03: every affected manifest now declares +"MIT OR Apache-2.0", matching LICENSE-MIT and LICENSE-APACHE. That is 27 +manifests -- 24 that said "BSD-3-Clause OR Apache-2.0", plus hanzo-kernel, +hanzo-kernel-macros and hanzo-3d, which said "BSD-3-Clause" alone. Those three +are first-party Hanzo work rather than candle-derived, so the choice of license +was ours to make; they are aligned here so that every crate offers what the +repository actually ships. + +hanzo-bindgen-cuda is deliberately left at "MIT". It is a fork of bindgen_cuda +by Nicolas Patry (https://github.com/Narsil/bindgen_cuda), which is MIT +upstream, and its manifest already retains his authorship. Changing it would +have relicensed a third party's work. + +Published versions are NOT being yanked. 191 published versions across 12 +crates on crates.io carry the incorrect SPDX, measured against the crates.io +API on 2026-08-03: + + hanzo-ml 87, hanzo-kernel 22, hanzo-kernels 19, hanzo-metal-kernels 17, + hanzo-nn 15, hanzo-flash-attn 10, hanzo-ug 9, hanzo-transformers 4, + hanzo-datasets 3, hanzo-onnx 2, hanzo-kernel-macros 2, hanzo-3d 1 + +Of those, 25 versions -- all of hanzo-kernel, hanzo-kernel-macros and hanzo-3d +-- were published as "BSD-3-Clause" alone, with no Apache-2.0 fallback. The +remaining 166 were published as "BSD-3-Clause OR Apache-2.0", so an Apache-2.0 +grant was at least always available for them. + +Two crates are unaffected and were already correct: tensor-tools (11 versions, +"MIT OR Apache-2.0", inherited from the workspace) and hanzo-bindgen-cuda +(1 version, "MIT", matching its own upstream). + +crates.io metadata is immutable per +version, so the label on those releases cannot be edited; yanking them would +break every downstream consumer in order to correct a label. The LICENSE files +distributed inside each of those crates are, and always were, LICENSE-MIT and +LICENSE-APACHE, and those are what actually grant rights. Anyone auditing an +older release should read the license files in the package rather than the +crates.io metadata field. + +Open item, not resolved here: the root LICENSE file is not upstream's. candle +ships no /LICENSE (only LICENSE-MIT and LICENSE-APACHE), and this file was +added by commit 225e590f (2026-02-14). It is a modified Apache-2.0 text -- the +APPENDIX is replaced with a single "Copyright 2024 Hanzo AI Inc" line and +several sentences are reworded. Because it is the only file named LICENSE, it +is the one GitHub reads, so this repository is reported as Apache-2.0 rather +than dual-licensed. It has been left untouched pending a decision, since +altering a file named LICENSE is a licensing determination rather than a +metadata fix. diff --git a/hanzo-3d/Cargo.toml b/hanzo-3d/Cargo.toml index 9408b4416..034a6d853 100644 --- a/hanzo-3d/Cargo.toml +++ b/hanzo-3d/Cargo.toml @@ -2,7 +2,7 @@ name = "hanzo-3d" version = "0.1.0" edition = "2021" -license = "BSD-3-Clause" +license = "MIT OR Apache-2.0" description = "3D representations, geometry, and mesh/point-cloud I/O for the Hanzo generative-3D stack (Pixal3D / TRELLIS / TripoSR)." repository = "https://github.com/hanzoai/ml" diff --git a/hanzo-datasets/Cargo.toml b/hanzo-datasets/Cargo.toml index 9dbe51c4e..266c2bca6 100644 --- a/hanzo-datasets/Cargo.toml +++ b/hanzo-datasets/Cargo.toml @@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz repository = "https://github.com/hanzoai/ml" keywords = ["blas", "tensor", "machine-learning"] categories = ["science"] -license = "BSD-3-Clause OR Apache-2.0" +license = "MIT OR Apache-2.0" readme = "README.md" [dependencies] diff --git a/hanzo-flash-attn-build/Cargo.toml b/hanzo-flash-attn-build/Cargo.toml index 5a0544f6e..b92b222e2 100644 --- a/hanzo-flash-attn-build/Cargo.toml +++ b/hanzo-flash-attn-build/Cargo.toml @@ -13,7 +13,7 @@ description = "Build-time helper that fetches and resolves the pinned NVIDIA CUT repository = "https://github.com/hanzoai/ml" keywords = ["cuda", "cutlass", "flash-attention", "build"] categories = ["development-tools::build-utils"] -license = "BSD-3-Clause OR Apache-2.0" +license = "MIT OR Apache-2.0" [lib] name = "hanzo_flash_attn_build" diff --git a/hanzo-flash-attn-v3/Cargo.toml b/hanzo-flash-attn-v3/Cargo.toml index abcbd7387..b64939371 100644 --- a/hanzo-flash-attn-v3/Cargo.toml +++ b/hanzo-flash-attn-v3/Cargo.toml @@ -7,7 +7,7 @@ description = "FlashAttention-3 (Hopper sm_90a) attention kernels for the Hanzo repository = "https://github.com/hanzoai/ml" keywords = ["blas", "tensor", "machine-learning"] categories = ["science"] -license = "BSD-3-Clause OR Apache-2.0" +license = "MIT OR Apache-2.0" readme = "README.md" [features] diff --git a/hanzo-flash-attn/Cargo.toml b/hanzo-flash-attn/Cargo.toml index ac89eb80f..1f44e6a88 100644 --- a/hanzo-flash-attn/Cargo.toml +++ b/hanzo-flash-attn/Cargo.toml @@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz repository = "https://github.com/hanzoai/ml" keywords = ["blas", "tensor", "machine-learning"] categories = ["science"] -license = "BSD-3-Clause OR Apache-2.0" +license = "MIT OR Apache-2.0" readme = "README.md" [dependencies] diff --git a/hanzo-kernel-macros/Cargo.toml b/hanzo-kernel-macros/Cargo.toml index c994c6628..ea7a1d5c1 100644 --- a/hanzo-kernel-macros/Cargo.toml +++ b/hanzo-kernel-macros/Cargo.toml @@ -3,7 +3,7 @@ name = "hanzo-kernel-macros" version = "0.1.1" edition = "2021" description = "The #[kernel(targets(...))] attribute for hanzo-kernel: one Rust fn, declared backends, scoped intrinsic islands." -license = "BSD-3-Clause" +license = "MIT OR Apache-2.0" repository = "https://github.com/hanzoai/ml" [lib] diff --git a/hanzo-kernel/Cargo.toml b/hanzo-kernel/Cargo.toml index 0e3f292b5..af80d975b 100644 --- a/hanzo-kernel/Cargo.toml +++ b/hanzo-kernel/Cargo.toml @@ -3,7 +3,7 @@ name = "hanzo-kernel" version = "0.2.40" edition = "2021" description = "Hanzo's first-party GPU kernel DSL: one Rust source, lowered to CUDA/ROCm/Vulkan/Metal." -license = "BSD-3-Clause" +license = "MIT OR Apache-2.0" repository = "https://github.com/hanzoai/ml" documentation = "https://docs.rs/hanzo-kernel" readme = "README.md" diff --git a/hanzo-kernels/Cargo.toml b/hanzo-kernels/Cargo.toml index 538ddab73..175a794ff 100644 --- a/hanzo-kernels/Cargo.toml +++ b/hanzo-kernels/Cargo.toml @@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz repository = "https://github.com/hanzoai/ml" keywords = ["blas", "tensor", "machine-learning"] categories = ["science"] -license = "BSD-3-Clause OR Apache-2.0" +license = "MIT OR Apache-2.0" [dependencies] diff --git a/hanzo-metal-kernels/Cargo.toml b/hanzo-metal-kernels/Cargo.toml index f25bad428..9d4ff3d51 100644 --- a/hanzo-metal-kernels/Cargo.toml +++ b/hanzo-metal-kernels/Cargo.toml @@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz repository = "https://github.com/hanzoai/ml" keywords = ["blas", "tensor", "machine-learning"] categories = ["science"] -license = "BSD-3-Clause OR Apache-2.0" +license = "MIT OR Apache-2.0" [dependencies] diff --git a/hanzo-ml-book/Cargo.toml b/hanzo-ml-book/Cargo.toml index b928f9039..af88a9f6a 100644 --- a/hanzo-ml-book/Cargo.toml +++ b/hanzo-ml-book/Cargo.toml @@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz repository = "https://github.com/hanzoai/ml" keywords = ["blas", "tensor", "machine-learning"] categories = ["science"] -license = "BSD-3-Clause OR Apache-2.0" +license = "MIT OR Apache-2.0" readme = "README.md" [dependencies] diff --git a/hanzo-ml-examples/Cargo.toml b/hanzo-ml-examples/Cargo.toml index e69605bdf..5960973f8 100644 --- a/hanzo-ml-examples/Cargo.toml +++ b/hanzo-ml-examples/Cargo.toml @@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz repository = "https://github.com/hanzoai/ml" keywords = ["blas", "tensor", "machine-learning"] categories = ["science"] -license = "BSD-3-Clause OR Apache-2.0" +license = "MIT OR Apache-2.0" readme = "README.md" [dependencies] diff --git a/hanzo-ml-pyo3/Cargo.toml b/hanzo-ml-pyo3/Cargo.toml index 7f5cc0b87..ef6a1e931 100644 --- a/hanzo-ml-pyo3/Cargo.toml +++ b/hanzo-ml-pyo3/Cargo.toml @@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz repository = "https://github.com/hanzoai/ml" keywords = ["blas", "tensor", "machine-learning"] categories = ["science"] -license = "BSD-3-Clause OR Apache-2.0" +license = "MIT OR Apache-2.0" readme = "README.md" [lib] diff --git a/hanzo-ml-wasm-examples/bert/Cargo.toml b/hanzo-ml-wasm-examples/bert/Cargo.toml index c746518e9..e83ab3a3c 100644 --- a/hanzo-ml-wasm-examples/bert/Cargo.toml +++ b/hanzo-ml-wasm-examples/bert/Cargo.toml @@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz repository = "https://github.com/hanzoai/ml" keywords = ["blas", "tensor", "machine-learning"] categories = ["science"] -license = "BSD-3-Clause OR Apache-2.0" +license = "MIT OR Apache-2.0" [dependencies] hanzo-ml = { workspace = true } diff --git a/hanzo-ml-wasm-examples/blip/Cargo.toml b/hanzo-ml-wasm-examples/blip/Cargo.toml index 99b96f71c..4fe8494dd 100644 --- a/hanzo-ml-wasm-examples/blip/Cargo.toml +++ b/hanzo-ml-wasm-examples/blip/Cargo.toml @@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz repository = "https://github.com/hanzoai/ml" keywords = ["blas", "tensor", "machine-learning"] categories = ["science"] -license = "BSD-3-Clause OR Apache-2.0" +license = "MIT OR Apache-2.0" [dependencies] hanzo-ml = { workspace = true } diff --git a/hanzo-ml-wasm-examples/llama2-c/Cargo.toml b/hanzo-ml-wasm-examples/llama2-c/Cargo.toml index 7ffaba610..805fed926 100644 --- a/hanzo-ml-wasm-examples/llama2-c/Cargo.toml +++ b/hanzo-ml-wasm-examples/llama2-c/Cargo.toml @@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz repository = "https://github.com/hanzoai/ml" keywords = ["blas", "tensor", "machine-learning"] categories = ["science"] -license = "BSD-3-Clause OR Apache-2.0" +license = "MIT OR Apache-2.0" [dependencies] hanzo-ml = { workspace = true } diff --git a/hanzo-ml-wasm-examples/moondream/Cargo.toml b/hanzo-ml-wasm-examples/moondream/Cargo.toml index b2a04b6b6..b663af93e 100644 --- a/hanzo-ml-wasm-examples/moondream/Cargo.toml +++ b/hanzo-ml-wasm-examples/moondream/Cargo.toml @@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz repository = "https://github.com/hanzoai/ml" keywords = ["blas", "tensor", "machine-learning"] categories = ["science"] -license = "BSD-3-Clause OR Apache-2.0" +license = "MIT OR Apache-2.0" [dependencies] hanzo-ml = { workspace = true } diff --git a/hanzo-ml-wasm-examples/phi/Cargo.toml b/hanzo-ml-wasm-examples/phi/Cargo.toml index d77dd2696..7bf54b85f 100644 --- a/hanzo-ml-wasm-examples/phi/Cargo.toml +++ b/hanzo-ml-wasm-examples/phi/Cargo.toml @@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz repository = "https://github.com/hanzoai/ml" keywords = ["blas", "tensor", "machine-learning"] categories = ["science"] -license = "BSD-3-Clause OR Apache-2.0" +license = "MIT OR Apache-2.0" [dependencies] hanzo-ml = { workspace = true } diff --git a/hanzo-ml-wasm-examples/segment-anything/Cargo.toml b/hanzo-ml-wasm-examples/segment-anything/Cargo.toml index a115bd320..25e0bcb51 100644 --- a/hanzo-ml-wasm-examples/segment-anything/Cargo.toml +++ b/hanzo-ml-wasm-examples/segment-anything/Cargo.toml @@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz repository = "https://github.com/hanzoai/ml" keywords = ["blas", "tensor", "machine-learning"] categories = ["science"] -license = "BSD-3-Clause OR Apache-2.0" +license = "MIT OR Apache-2.0" [dependencies] hanzo-ml = { workspace = true } diff --git a/hanzo-ml-wasm-examples/t5/Cargo.toml b/hanzo-ml-wasm-examples/t5/Cargo.toml index 4f9993e60..398c0b9bc 100644 --- a/hanzo-ml-wasm-examples/t5/Cargo.toml +++ b/hanzo-ml-wasm-examples/t5/Cargo.toml @@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz repository = "https://github.com/hanzoai/ml" keywords = ["blas", "tensor", "machine-learning"] categories = ["science"] -license = "BSD-3-Clause OR Apache-2.0" +license = "MIT OR Apache-2.0" [dependencies] hanzo-ml = { workspace = true } diff --git a/hanzo-ml-wasm-examples/whisper/Cargo.toml b/hanzo-ml-wasm-examples/whisper/Cargo.toml index dbc439ca0..bb1bdf08a 100644 --- a/hanzo-ml-wasm-examples/whisper/Cargo.toml +++ b/hanzo-ml-wasm-examples/whisper/Cargo.toml @@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz repository = "https://github.com/hanzoai/ml" keywords = ["blas", "tensor", "machine-learning"] categories = ["science"] -license = "BSD-3-Clause OR Apache-2.0" +license = "MIT OR Apache-2.0" [dependencies] hanzo-ml = { workspace = true } diff --git a/hanzo-ml-wasm-examples/yolo/Cargo.toml b/hanzo-ml-wasm-examples/yolo/Cargo.toml index aa601888d..94e047419 100644 --- a/hanzo-ml-wasm-examples/yolo/Cargo.toml +++ b/hanzo-ml-wasm-examples/yolo/Cargo.toml @@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz repository = "https://github.com/hanzoai/ml" keywords = ["blas", "tensor", "machine-learning"] categories = ["science"] -license = "BSD-3-Clause OR Apache-2.0" +license = "MIT OR Apache-2.0" [dependencies] hanzo-ml = { workspace = true } diff --git a/hanzo-ml/Cargo.toml b/hanzo-ml/Cargo.toml index 4b60ccb25..38531bbc3 100644 --- a/hanzo-ml/Cargo.toml +++ b/hanzo-ml/Cargo.toml @@ -6,7 +6,7 @@ description = "Fast multi-backend tensor & ML framework for Rust (CPU/CUDA/Metal repository = "https://github.com/hanzoai/ml" keywords = ["blas", "tensor", "machine-learning"] categories = ["science"] -license = "BSD-3-Clause OR Apache-2.0" +license = "MIT OR Apache-2.0" readme = "README.md" [dependencies] diff --git a/hanzo-nn/Cargo.toml b/hanzo-nn/Cargo.toml index e70f68033..582be670b 100644 --- a/hanzo-nn/Cargo.toml +++ b/hanzo-nn/Cargo.toml @@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz repository = "https://github.com/hanzoai/ml" keywords = ["blas", "tensor", "machine-learning"] categories = ["science"] -license = "BSD-3-Clause OR Apache-2.0" +license = "MIT OR Apache-2.0" readme = "README.md" [dependencies] diff --git a/hanzo-onnx/Cargo.toml b/hanzo-onnx/Cargo.toml index 41f5026e6..1799dadfc 100644 --- a/hanzo-onnx/Cargo.toml +++ b/hanzo-onnx/Cargo.toml @@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz repository = "https://github.com/hanzoai/ml" keywords = ["blas", "tensor", "machine-learning"] categories = ["science"] -license = "BSD-3-Clause OR Apache-2.0" +license = "MIT OR Apache-2.0" [dependencies] hanzo-ml = { path = "../hanzo-ml", package = "hanzo-ml", version = "0.11.8" } diff --git a/hanzo-training/Cargo.toml b/hanzo-training/Cargo.toml index 502547911..80f8b49d0 100644 --- a/hanzo-training/Cargo.toml +++ b/hanzo-training/Cargo.toml @@ -6,7 +6,7 @@ description = "Training framework for Hanzo ML models on zen-agentic-dataset" repository = "https://github.com/hanzoai/ml" keywords = ["machine-learning", "training", "transformer", "llm"] categories = ["science", "algorithms"] -license = "BSD-3-Clause OR Apache-2.0" +license = "MIT OR Apache-2.0" readme = "README.md" [dependencies] diff --git a/hanzo-transformers/Cargo.toml b/hanzo-transformers/Cargo.toml index 9d9974fa4..6d0152cef 100644 --- a/hanzo-transformers/Cargo.toml +++ b/hanzo-transformers/Cargo.toml @@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz repository = "https://github.com/hanzoai/ml" keywords = ["blas", "tensor", "machine-learning"] categories = ["science"] -license = "BSD-3-Clause OR Apache-2.0" +license = "MIT OR Apache-2.0" readme = "README.md" [dependencies] diff --git a/hanzo-ug/Cargo.toml b/hanzo-ug/Cargo.toml index 8fa5b2e4f..de3b2c5f4 100644 --- a/hanzo-ug/Cargo.toml +++ b/hanzo-ug/Cargo.toml @@ -6,7 +6,7 @@ description = "Multi-backend tensor & ML framework for Rust — part of the Hanz repository = "https://github.com/hanzoai/ml" keywords = ["blas", "tensor", "machine-learning"] categories = ["science"] -license = "BSD-3-Clause OR Apache-2.0" +license = "MIT OR Apache-2.0" [dependencies] ug = "0.5.0" From 21831fa9264f3d22f4ddb22bf6c27d56d5df0af4 Mon Sep 17 00:00:00 2001 From: hanzo-dev Date: Mon, 3 Aug 2026 20:20:18 -0700 Subject: [PATCH 2/2] legal: the 28th manifest, which declared no licence at all MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The BSD sweep fixed 27 manifests that declared the wrong licence and missed the one that declared none. hanzo-ml-wasm-tests is a workspace member with no `license` and no `publish = false`, so a single `cargo publish` would have sent it to crates.io with no licence field — the same class of error, one step further along. It has never been published; crates.io returns "crate does not exist". Now "MIT OR Apache-2.0" like the rest. Every Cargo.toml in the repository carries a licence field, and hanzo-bindgen-cuda's "MIT" is the only differing value, which is correct — it is Nicolas Patry's bindgen_cuda and normalising it would relicense his work. Re-measured the published metadata against the crates.io API rather than trusting the number already in NOTICE: 191 versions across 12 crates still carry the wrong SPDX, of which 25 (all of hanzo-kernel, hanzo-kernel-macros, hanzo-3d) are BSD-3-Clause with no Apache fallback. Both figures still hold. tensor-tools (11 versions) and hanzo-bindgen-cuda (0.1.7) were and are correct. Co-authored-by: Hanzo Dev --- NOTICE | 7 +++++++ hanzo-ml-wasm-tests/Cargo.toml | 1 + 2 files changed, 8 insertions(+) diff --git a/NOTICE b/NOTICE index d2bbe06eb..e787969b1 100644 --- a/NOTICE +++ b/NOTICE @@ -124,6 +124,13 @@ are first-party Hanzo work rather than candle-derived, so the choice of license was ours to make; they are aligned here so that every crate offers what the repository actually ships. +A 28th manifest, hanzo-ml-wasm-tests, declared no license at all. It is a +workspace member without `publish = false`, so it was one `cargo publish` away +from going out unlicensed; it has never been published (crates.io has no such +crate). It now declares "MIT OR Apache-2.0" like the rest. Every manifest in +the repository now carries a license field, and hanzo-bindgen-cuda's "MIT" is +the only value that differs -- deliberately, for the reason below. + hanzo-bindgen-cuda is deliberately left at "MIT". It is a fork of bindgen_cuda by Nicolas Patry (https://github.com/Narsil/bindgen_cuda), which is MIT upstream, and its manifest already retains his authorship. Changing it would diff --git a/hanzo-ml-wasm-tests/Cargo.toml b/hanzo-ml-wasm-tests/Cargo.toml index 2ce6daeaa..9e617fd49 100644 --- a/hanzo-ml-wasm-tests/Cargo.toml +++ b/hanzo-ml-wasm-tests/Cargo.toml @@ -3,6 +3,7 @@ name = "hanzo-ml-wasm-tests" version = "0.11.8" edition = "2021" description = "WASM tests for hanzo" +license = "MIT OR Apache-2.0" keywords = ["blas", "tensor", "machine-learning"] categories = ["science"]